Internal Audit within the Financial Services Authority

1
Internal Audit within the Financial Services
Authority

• James GlassDirector, Business Review and Audit
  Division

2
Financial Services Authority

• Financial Services and Markets Act
• FSA vision
• The FSA aims to be a world-leading regulator,
  respected for its effectiveness, integrity and
  expertise
• Statutory objectives
• maintaining confidence in the financial system
• promoting public understanding of the financial
  system
• securing the appropriate degree of protection for
  consumers
• reducing the risks of financial crime

3
Which must be pursued in line with a set of
principles of good regulation

• economy and efficiency in the use of resources
• recognising the responsibilities of management
• acting proportionately
• recognising
• the value of innovation and competition
• the international character of the UKs financial
  markets

4
Statutory objectives fulfilled by strategic aims

• Maintaining efficient, orderly and clean
  financial markets
• Helping retail consumers achieve a fair deal
• Making the FSA a more efficient organisation

5
To whom are we accountable?
Parliament
H M Treasury
Treasury Select Committee
FSA BOARD
Practitioner Panel
Consumer Panel
11 Non-Executives 4 Executives
6
Organisational structure to achieve objectives
7
Organisational structure to achieve objectives

• Key features of structure
• 3 main strategic business units
• Direct reporting divisions of specific services
• Sector leader focus
• Matrix structure

8
Business Review Audit in the structure
Chairman
Audit Committee
CEO
Business Review Audit
9
BRAD Mission

• Use independent reviews
• to provide an objective opinion to the Audit
  Committee and FSA Board
• on whether robust, fit for purpose risk
  management frameworks are being maintained and
  operated by management
• whether these comply with the corporate
  governance requirements of Turnbull
• Adopting a risk based approach to establishing a
  sound system of internal control and reviewing
  its effectiveness).

10
BRAD Structure and Skills Mix
KAREN BARNETT Director's PA
ERNST YOUNG Strategic Partners
JAMES GLASS Director
PAUL FROST Manager
KAREN DIGNAN Manager
Senior Audit Consultants and Audit
Consultants 50 professionally qualified 2
external secondees 2 currently seconded to other
parts of the FSA Use of specialist skills from
Strategic Partners Increasing range of high
potential staff and supervision experience
11
Corporate Governance

• Combined Code UK
• Sets out principles and provisions
• Listed companies have to make statements
• How it applies the principles
• statements are not prescribed and companies have
  a free hand to explain their governance policies
• That the company has complied with the provision
  of the code or where it does not to provide an
  explanation
• Comply or explain approach in operation for
  more than 10 years and its flexibility is
  welcomed by Boards and investors
• The FSA is not a listed company but sets out to
  comply with best practice where possible

12
Risk Assessment Framework
Board Approval
Consolidated Risk Map
Divisional and Business Unit Risk Assessment
Risk Assessment Tables
13
How we do this in practice
14
Risk Assessment
15
Overall BRAD framework for providing independent
assurance
INDEPENDENT ASSURANCE
16
Risk Based Approach - Planning
17
Example Arrow Review

• Definition
• Advanced Responsive Risk Operating frameWork
• Used to assess a firms risk to the FSAs
  objectives
• The Arrow Approach
• Review against business and control risk
• Focus business and control risks and on statutory
  objectives
• Producing impact and probability score and an
  overall score
• BRAD objectives
• Provide independent assurance to the Chairman and
  the Board of the operation of the Arrow firm
  specific framework and its effectiveness and fit
  for purpose.

18
Arrow Review - The BRAD approach

• 3 stage process
• Arrow roll out
• Review of how Arrow had been applied to
  individual firms
• Risk Mitigation Plans
• Review of approach and implementation to risk
  mitigation programmes
• Feedback to firms
• Interview of firms senior contacts to establish
  their views on the Arrow approach in practice
• Summary of findings from all reviews

19
Arrow Review outcomes and recommendations

• Overall findings cross FSA and individual
  division level
• FSA programme of change to ARROW underway
  incorporating BRAD results
• Preliminary assessments
• More focus and added value
• Discovery
• Focus and use of information. Close out
• Scoring
• No one size fits all. Impact vs probability
• Validation panels
• Standards and good practice
• Risk Mitigation Programmes
• SMART actions and outcomes and better monitoring
• Communication
• Accuracy and transparency

20
Action Tracking and Follow ups
BRAD final report
High and Medium High risks into Tracking system
Monthly tracking of agree actions Directors asked
to confirm either completion of actions or
explanations for any delays with revised dates
Monthly tracking reports
Monthly report of actions to Executive
Committee Explanations for all overdue
actions Chief Executive discusses with MDs
responsible
Monthly reports to ExCo
Quarterly reports Audit Committee
Quarterly report of actions to Audit
Committee Explanations for all overdue actions
Follow up testing when actions
completed Report on implementation and
re-instate on tracking reports if not complete
Regular Follow up
21
Trends in the BRAD approach

• Increasing request for review of new processes
  and for ad-hoc advice and guidance
• More specialist and in depth reviews being
  undertaken
• Role in special investigations
• Projects and Programmes for change
• More challenging plans
• Greater focus on skills and development of BRAD

22
The challenge for BRAD

• BRAD role in adding value and achieving
  objectives of the FSA
• Obligation to provide independent assurance
• Need to add value without stepping outside
  independent assurance role
• Must not take on line management responsibilities
  that will dilute our ability to audit or to
  provide independent comment
• Delicate balancing act

23
BRAD Strategic Plan

• Business Add value
• Relationships Work in Partnership
• Assurance Independence Objectivity
• Delivery Dynamic Influential

24
Questions